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We give graphical characterisation of the access structure to both classical and quantum 
ri ' information encoded onto a multigraph defined for prime dimension q, as well as explicit 

rS ,. decoding operations for quantum secret sharing based on graph state protocols. We give a 

lower bound on k for the existence of a ((fc, n))q scheme and prove, using probabilistic 
r^ I methods, that there exists a such that a random multigraph has an accessing parameter 

C^ ■ fc < an with high probability. 

1 Introduction 

^ . In this work we consider encoding, and accessing, both quantum and classical information onto 

*/^ ' graph states of qudits - multipartite entangled states which are one to one corresponding to 

multigraphs (which we will consider as simple graphs with multiple edges). We are particularly 
interested in using these states for secret sharing. 

Secret sharing is an important cryptographic primitive, which was first put forward classi- 
cally in 1 29 1, and then extended to the quantum realm in [17 8|. The aim of the protocol is for 
7^ . a dealer to distribute a secret (quantum or classical) to a set of players, in such a way that only 

authorized sets of players can access the secret, and unauthorized sets of players cannot (there 
may be sets of players which are neither authorized nor unauthorized). The sets of authorized 
and unauthorized players is called the access structure. Any secret sharing scheme of n players 
can be loosely paramaterised by two numbers, k and k', such that any subset of k players is an 
authorized set, whereas any subset of fc' players or less is unauthorized. We call such parama- 
terised schemes (fc, fc', n) ramp schemes. In the case when fc' = fc — 1, we say it is a threshold 
scheme, and simplify the notation to (fc, n). 

In this work we consider two classes of quantum schemes, one class using quantum channels 
to distribute classical secrets, denoted CQ schemes ifTTI . and the other sharing quantum secrets 
(SlITll, denoted QQ schemes. The notation CQ and QQ used here follows the work f27"24'l25], 
where both classes were phrased in the same language of graph states (first for qubits [27] then 
qudits Il24ll25l ). The equivalence of both schemes was shown in li25l . Using the graph state 
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formalism can be useful both practically - since graph states are amongst the most well devel- 
oped multipartite entangled states experimentally - and theoretically, since graph states are rich 
in their uses in quantum information, and allow for graphical characterization of information 
flow, and access of information. The connection between error correction and secret sharing 
was understood early on [8 1, and implies that for general access structures it is necessary to use 
high dimensional states to encode the secret |27, 25|. In |22| an entirely graphical description 
of the access structure was given for the graph state protocols on qubits. This has led to many 
applications, for instance in proving lower and upper bounds on what is k and k' are possible in 
ramp schemes. We are naturally interested in doing the same for higher dimensional versions. 

The first result of this paper is to extend to higher dimension the characterisation of the 
access structure in a graph, previously done in [22] for 2-dimensional system. By gathering the 
graphical conditions and previous results, we show that the accessibility problem to quantum 
information can be reduced to study the classical information's one in both a set of player and 
its complementary (which was proved in [S", 19| for 2 dimensional system). Finally we use 
this result for the decoding phase of both QQ and CQ protocols, as we know |25| that a CQ 
authorised is a QQ authorised set and vice versa. In the last part, we study the existence, as a 
function of fc, of a ((fc, n))q scheme (this will be defined explicitly later, but can be understood 
as the underlying graph encoding which gives rise to (fc, n — k,n) QQ secret sharing schemes). 
We derive a lower bound over k, that is, there exists a such that every (fc, n — k, n) QQ secret 
sharing must satisfies k > an, and we use probabilistic method to find c < 1 such that a 
{{en, n))q scheme exists with high probability. 

2 Background 

2.1 Qudit graph states, F*-graphs, and multigraphs 

The qudit graph state formalism (|Tl[32l consists of representing a quantum state using a weighted 
undirected graph where every vertex represents a g-dimensional quantum system and every 
edge, which has assigned an element from the finite field Fg, represents intuitively the entan- 
glement between the elementary systems (a formal definition is given in Definition [U. Such 
graphs, labeled with elements of a finite field Fg, are known as ¥*-graphs f2T\ and can be can 
be interpreted as edge-colored graphs. In this paper, we choose to interpret F*-graphs as multi- 
graphs i.e., graphs with possibly parallel edges between pairs of vertices. Albeit equivalent to 
the other interpretation of F* -graphs, we believe that the multigraph interpretation is relevant 
in the context of qudit graph states for secret sharing protocols, in particular for the graphical 
characterisation of authorised and unauthorised sets of players (see Lemmas [T] and |2]i. 

Definition 1 (q-multigraphs). Given a prime number q, a q-multigraph G is a pair {V, T) where 
V is the finite set of vertices and F : 1/ x 1/ — >■ Fg w the adjacency matrix ofG: for any u,v £V, 
F(m, v) is the multiplicity of the edge {u, v) in G. 

The term multigraph is used for q-multigraph when q is clear from the context or irrelevant. 
In this paper, we consider undirected simple multigraphs G ~ {V,T) i.e., for any vertices 
u,v G V, T{u,v) = r{v,u) andF(M, u) — 0. For our characterizations of encoding and 
accessing later on, it will be useful to introduce further concepts. We will see several examples 
of them along the way, but for now we state definitions. Given a set V of vertices, a vector 
D : V —>■ W^ represents a multiset of vertices of V: for every v £ V, D{v) G Fg is the 
multiplicity of v in D. sup(Z?) — {v lE V \ D{v) ^ mod q] is the support of D. For any 
multigraph G — {V,T) and any multiset of vertices D : V ^ Fg, the matrix product T.D 
is the multiset of neighbours of D: for any we V , v \s a. neighbour of D with multiplicity 



{T.D){v) = J2uev ^(^' v)-D{u) mod q. In particular, for any vertex u, r.{u} is the multiset 
of neighbours of u. We call G[D] = {V' , V) the sub-multigraph of G = (V, F) induced by 
the multiset D : V ^ ¥q, where V = V sup(D) and T' : V x V ^ ¥q ^ {u, v) h-> 
D{u).T{u, v).D{v) mod g. Notice that the multiplicity of an edge in G[D\ is the multiplicity 
of this edge in the original graph G times the multiplicity in D of the two vertices connected by 
this edge. For any A,BCV, r[A, B] denotes the submatrix of F whose columns correspond 
to the vertices in A and rows to the vertices in B. r[A, B] represents the edges which have one 
end in A and the other one in B. 

Definition 2 (Qudit Graph State). Given a q-multigraph G — (V, F) with V — {wi, . . . , w„}, 
let \G) e C* be its associated qudit graph state defined as 



\G) 



E 



c.l'^WIlx) 



X = (xi,--- ,Xn)£V^ 



where uj is the q''' root of unity and \G[x]\ is the number of edges of the sub-multigraph 

G[x\ = (T4,Fa;) induced by x, where Vx = {vi G V,Xi ^ 0} and F^; : 14 x 14 -> F^ = 

{Vi,Vj) H> XiX-jT{vi,Vj). 



Qudit graph states satisfy the following fundamental fixpoint property. Given a g-multigraph 
G = (y, F), \G) is the unique quantum state (up to a global phase) such that, for any u £ V, 

X^Zr.{u}\G) ^ \G) (1) 

where F.{w} is the multiset of neighbours of u, X — \b) i-^ |& + 1 mod q), Z = \b) h^ a;''|6) 
are Pauli operators, and for any mulitset D : V ^)- ¥q, Zo '■= ®i,ey ^v ■ 

Example 1. We define the i-multigraph G = {V, T)byV = {wi, W2, W3, U4, W5}, 
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Let A = {di, V2\ be a subset of V , and D : A — >■ F3 a multiset such that D{vi) = 2, D(v2) — 1- 
That is D = {vi,v\, V2}. Then, with previous definitions, the graph induced by D is G[D\ — 
@ 




The multiset of neighbours of A is {wi, W2, "^5, W5}. The multiset of neighbours of D is 

{wi,W2,W2,W3}. 



@ 



2.2 Local complementation and cut rank 

The local complementation |I5| is a graph transformation which is incredibly useful for the 
study of graph states fSTl. Indeed, if two graphs G and G" are locally equivalent (i.e. one 
can transform G into G' by means of a series of local complementations), they represent the 
same entanglement (i.e. there exists a local unitary transformation U such that \G') = U\G)) 
II3TI . Local complementation is extended to multigraphs as follows fTi\: Given a g-multigraph 
G = (V,F), M e y and A e F^, the X-local complementation at u of G is the g-multigraph 



Gir^u = (V, r') such that ^v,w eV,v^ w, T'{v, w) = r{v, w) + \.T{v, u).r{u, w) mod q. 
Keet et al. f24!| have proved that for any q-multigraph G — {V, F), any u E V and any A e F,, 
there exists a local unitary transformation U such that \G-k^u) — U\G). 

The cut rank |^8 1 is a set function which associates with every set B of vertices the rank 
of the matrix describing the edges of the cut (B, V\B): Given a multigraph G — {V, F), let 
T[B] := r[B, V\B] be the cut matrix of the cut (B, V\B), moreover for any A,BCV, let 
rkG(A, B) := rank(F[y4, B]) and cutrkciB) := rkG(-B, V\B) be the cut rank of B. Notice 
that rkG(^, B) = rkciB, A) and cutrkG(S) = cutrkG(l^\B). 

We point out in this paper that the cut rank, which is known to be invariant by local com- 
plementation ||2TI . is a key parameter of g-multigraphs for the study of secret sharing protocols 
with qudit graph states. Indeed, Theorem |2] states that the capability of a set of players to re- 
construct a quantum secret is characterised by the discrete derivative of the cut rank function. 
Notice that the cut-rank of a bipartition is nothing but the Schmidt measure of entanglement of 
this bipartition in the corresponding graph state. This is shown for the qubit case in |15|, and 
easily extends to the qudit case. As a consequence, Theorem|2]characterises the accessibility of 
a set of players as the derivative of the Schmidt measure of entanglement. 

2.3 Description of the encoding: 

We now introduce the encoding of classical and quantum information onto graph states (CQ 
and QQ respectively), which will be the starting point for the secret sharing protocols defined 
in sectionlD For ease of notation we present the CQ encoding as deterministic, and in one basis. 
When used in the full CQ protocol this is randomised by measurement and choice of basis (de- 
scribed fully in sectionlUl. The ability of players to access encoded information (both classical 
and quantum) is fuUy described in graph theoretical language in section [3] 

CQ encoding: 

Given a multigraph G = {V, F) of order n and a distinguished non isolated vertex d G V, the 
corresponding CQ encoding of a classical secret s E ¥q among n — 1 players consists of the 
dealer preparing the state 

|si):=Zf{,j|G\d), 

and sending one qudit to each player, where G\d — {V\{d}, r[V\{d}, V\{d}]) is the multi- 
graph obtained by removing the vertex d and all its incident edges. 

In the CQ protocol (described in section |4) the secret s is randomised by measurement on 
the dealer's vertex d of the full graph state \G), and further, the encoding is randomised by 
choice of measurement basis - the dealer chooses at random t G T,T C Wq and |r| > 2, and 
measures his qudit in the associated complementary basis X^Z. Measuring in this t basis will 
correspond exactly to using the above CQ encoding of the same secret value s onto the comple- 
mentary multigraph G-k^d. 

QQ encoding: 

Given a multigraph G — {V, F) of order n and a distinguished non isolated vertex d E V, 
the corresponding QQ encoding on a qudit graph state for sharing an arbitrary quantum secret 
\(t>) = Yl']=o ^j \j) ^ ^"^ among n — 1 players consists, for the dealer, in preparing the state 

9-1 q-1 

J=0 J=0 



and in sending one qudit of |0l) to each player. 

Notice that the preparation consists in applying the map |j) i-> Zp r^ji |G\(i) which is an 
isometry as long as d is not an isolated vertex in G. We describe encoding procedures in 
appendix!?] 

The accessing structure of the protocols (i.e. the description of the sets of players which can 
recover the secret, as well as those which have no information about the secret) is given in the 
next section which provides a graphical characterisation of the accessing structure for the secret 
sharing protocols using these encodings. Moreover, the operations the authorised sets of players 
have to perform to reconstruct the secret are also described in the next section. 

3 Access Structure in a Graph in Higher Dimension: 
3.1 Classical Information 

In this section, we show, when the secret is classical, that the protocol is perfect (i.e. every set 
of players is either able to recover the secret or has no information about the secret), and that 
the accessing structure is graphically characterised by a simple rank-based function: 

Theorem 1. Given a q-multigraph G = (V, F) and a distinguished vertex d & V, a set B C 
y\{(i} of players can recover a classical secret for the corresponding CQ encoding if and only 

if'iTQ{B^d) = 1, where 

ttg{B, d) ;= cutrkG(B) - cutrkG\d(S) 

A graphical interpretation of Theorem [T] is that a set B is accessible if and only if the 
presence of the 'dealer vertex' d increases the rank of the cut between B and the rest of the 
vertices. 

The rest of the section is dedicated to the proof of Theorem[T] 

First, we prove that a set B of players can recover a classical secret if, roughly speaking, 
there exists a multiset D of them which is not 'seen' from outside except by the 'dealer' : 

Lemma 1. Given a q-multigraph G = (V, F) and d Cz V, a set B C V\{d} of players 
can recover a classical secret for the corresponding CQ encoding if there exists a multiset 
D : B ^¥q such that sup(F[B, V\B].D) = {d} i.e., 

• the number of neighbours of d in D is not congruent to mod q; 

• Vw G V\{B\j{d}), the number of neighbours ofu in D is congruent to mod q. 

Proof Given B <Z V and D : B ^ Vq such that s\i^{T[B ,V\B].D) ^ {d}. W.l.o.g. we 
assume the multiplicity of d in T.D is 1 (otherwise we consider the multiset D' — u i-^ 
(T .D){d)^^ .D{u) instead of D). The players in B can recover the secret by measuring an ap- 
propriate product of stabilizers. Indeed, there exists r G F^ such that J|^g^(XtjZr.{„})'^^"'' = 
Lu^XoZro = ZdUJ^XDZr[v,v\{d}].D- AsllueBi^uZr.{u})'"-''MG) = |G), we deduce that 
uj'''XDZr[vv\{d}] D\G\d) = \G\d). If the classical secret is s g Fg, 

u^XDZr[v,v\{d}iDZ^,^^y\G\d) = uj--'Z^^^^XDZr[v,v\{d}].D\G\d) = uj~'Z^^^y\G\d). 
So if the players in B measure according to uj'^XDZriv,v\{d}].D, they get the outcome —s mod 
q, so they recover the classical secret s. D 

Lemma [T] provides a sufficient condition for a set of players to be able to reconstruct a 
classical secret. Notice that this reconstruction is nothing but a Pauli measurement, so it can be 
done by means of local Pauli measurements and classical communications. 



Corollary 1. Given a q-multigraph G = {V,T), d &V, and B C V\{d}, ifT:G{B,d) = 1 
then B can reconstruct a classical secret for the corresponding CQ encoding. 

Proof. Let F = V\{BU{d}). According to lemma[T] B can recover a classical secret if there 

exists D : B ^> ¥q such that snp{r[B,V\B].D) ~ {d}. W.l.o.g. we can assume that the 

multiplicity of d in T[B, V\B].D is one. So B can recover a classical secret if the system 

r[s,{4] \ fl\^ , . u-u- • , ,/^r[B,{d}] 

1^—1 _^ jj^g ^ jjQjj 2ero solution, which is equivalent to rank ' 



T[B,F] J \ J ' V ^[B,F 

Using the last column of the right-side matrix to cancel terms of 



rank'^^IM^ 



r[B,F] 







the row T[B, {d}], we are finally reduced to rank ( ' . ) = 1 + rank(r[_B, F]) i.e., 

cutrkG(B) - rkaiB, F) = I = ttg{B, d). D 

In the following, a sufficient condition for a set of players to have no information about the 
secret is introduced: roughly speaking, a multiset of players D which includes the dealer d, can 
'hide' the secret to every player who is connected to D with a number of edges congruent to 
modulo q: 

Lemma 2. Given a q-multigraph G = (V, F) and d (z V, a set B C V\{d} has no information 
about a classical secret for the corresponding CQ encoding if there exists D : V\B — >■ F^, such 
that D{d) ^ mod q and T[V\B, B].D = i.e., 

• the multiplicity of d in D is not congruent to mod q; 

• Vw e B, the number of neighbours ofu in D is congruent to mod q. 

Proof W.l.o.g. we assume D{d) = 1 mod g. Notice that R\G\d) {G\d\E) = \G\d){G\d\ 

with R = ]\uev\{Bu{d}) i^uZr[v\{d}y\{d}].{u})"'''^^ ■ Moreover R.Zr,{u} is only acting on 
V\{BVJ{d]), so the reduced density matrix for the players in B is 

Try\^Bu{d}){Z'r.{d}\G\d){G\d\Z^r.{d)) 

= Trv\iBu{d}){{Zv.{d}Ry\G\d){G\d\{Zr.{d}Rt) 
= Trv\(B^{d})(\G\d){G\d\) 
which does not depend on the secret, so the players in B have no information about the secret. 

D 

Corollary 2. Given a q-multigraph G = {V,V), d £V, and B C V\{d), ifnciB^d) = 
then B has no information about the classical secret for the corresponding CQ encoding. 

Proof Let F — V\{BU{d}). According to lemma |2] B has no information about classical 
secret if there exists D : V\B -J> ¥g such that D{d) = 1 mod q and r[V^\i?, B].D = 0, so 
if r[F, B].C = -r[V^, B]{d}, where G : F ^ ¥q ^ u ^ D{u) is the restriction of D to 
F. As a consequence, B has no information about classical secret if the system T[F, B].x — 
—T\V,B]{d] has a non zero solution, which is equivalent to find a non zero solution to the 
system T[F,B].x = T[V,B]{d}, so if rank(r[F, B]) = rank(r[V"\B, B]) i.e., iraiB^d) = 
0. D 

Proof of Theorem[T] The proof of Theorem[T]follows from Corollaries [TjandHand the fact that 
for every B, Q < TrG{B, d) < 1. It proves that the encoding is perfect i.e., every set of players 
is either able to reconstruct the secret (when TrG{B, d) = 1) or has no information about the 
secret (when TTciB, d) = 0). 



3.2 Quantum Information 

In the following we prove that the accessibility of a set a players is characterised by the deriva- 
tive of the cut-rank function with respect to the dealer. 



Theorem 2. Given a q-multigraph G with a distinguished dealer d G V{G), a set B C 
^(^)\{'^} of players can recover a quantum secret in the corresponding QQ encoding iff 

ddCubkaiB) = -1 

where ddCutTkc{B) — cutrkG(i?U{(i}) — cutrkG'(_B) is the discrete derivative o/cutrkc in B 
with respect to d. 

Proof. It is known that B can access a quantum secret in G iff B can access a classical secret in 
two mutual unbiased bases, say in G and G *^ d 1.251. Moreover B can access a classical secret 
inGiff7rG(S,d) = 1, where 7rG(S,d) = cutikaiB) ~TkG{B,V\{BU{d})). 
(=>) If B can access a quantum secret, B can access a classical secret and V\{BU{d}) has no 
information about a quantum secret JS], which implies that V\{BU{d}) cannot access a classi- 
cal secret. Thus ttg{B, d) = 1 and TTG{V\{B\j{d}) , {d}) = 0. As a consequence ttg{B, d) — 
7rG(l^\(SU{d}), {d}) = 1, so 1 = cutrk(B) - rkcCS, V\(B\j{d})) - cutrk(t/\(BU{4)) + 
rkG(y\(SU{d}), B) = cutrk(B) - cutrk(y\(BU{4)) = cutrk(B) - cutrk(BU{d}). 
(<^) If cutrkG(S) = cutrkG(SU{(i}) + 1, then 7rG(S,{rf}) = 1, so i? can access a clas- 
sical secret in G. Moreover, since the cut rank is invariant by local complementation lISTI . 
cutrkG*i(i(S) — cutrkG*id(^U{(i}) + 1, so _B can also access a classical secret in G-k^d. D 

Notice that for any set B of players, (9dCutrkG(i?) e { — 1, 0, 1}: if 9dCutrkG(i?) ~ -1, B 
can recover the quantum secret; if 9dCutrkG(i?) = 1 they have no information since V"\(i?U{(i}) 
can recover the quantum secret; and if 9(iCutrkG(i?) = they have some partial information 
about the secret. 

Since the cut rank function is submodular ["281, its derivative is monotonic (decreasing): if 
B C B' , ddC\ArkQ(B) > ddCiiXik{B'). Indeed, if i? can recover the secret, any superset B' of 
B can recover it too; and if B' has no information about the secret, any subset B of B' has no 
information too. 



4 Application to CQ and QQ protocols 

We now see how the encoding of section IZJl and the results on access structures in section |3] 
can be used to provide secret sharing protocols. Following the prescription of [25] (based on 
Il27ll24l . see also ll26l ) we will now introduce two protocols, one for sharing classical secrets 
over a quantum channel (CQ) and one for sharing a quantum secret (QQ), both based on a 
graph state associated with a multigraph. Both protocols can be understood as using the graph 
state as a channel between the dealer (associated with vertex d) and the players (the remaining 
vertices). In the CQ case this channel is used to perform an Ekert-like key distribution protocol 
between the dealer and authorised players, so that when completed the dealer and authorised 
players will share a random 'dit' string which is unknown to anybody else. In the QQ case the 
channel is used to teleport the secret to the players such that only authorised sets of players can 
access the information (the QQ encoding in section l273] can be understood as this teleportation, 
see Appendixl?). More details on the protocols and their relation to each other as well as error 
correction can be found in [|25l . 



4.1 Detailed protocols 

Before we write the full protocols out, we first review some background on the graph state 
formalism, which will be the key in seeing how the stabilisers can be used to specify how 
authorised sets can access the information, given the satisfaction of the conditions outlined in 
the previous section. 

Given a multigraph G = {V, F), we begin with an illustrative expansion of the graph state 
\G)v according to the d, V\{d} partition. 



-^J2\'^d\iL)v\{d} 



for any t E ¥q, where the second line follows from definitions in section 12.31 correspond- 
ing to the CQ encoding achieved by the dealer measuring in the Z basis. The third line cor- 
responds to when the dealer measures in bases X'^Z (explained in more detail later), where 

they ai-e defined as |i(0)) = \i), and \i{t)) = ^ El=d '^^^^^"'* '^b') for ^ = 1-9 - 1' 
so that X^Z\i{t)) = u}'\i{t)), and further |i'(0)L) = I^l) = Z'^^^y\G\d) and \i'^{t)) := 

7f Efc=o ^ "'2'' " +**"''' Ifci) for t = l...q~l. The state |i'(i)i)y\{<i} is equivalent to the CQ 
encoding of i on graph G ** d 124). 

We now look at how the conditions for access arrived at in section[3]can be used, along with 
the stabiliser (or "fixed point") condition ([TJ, to eventually see how authorised sets can access 
the information in the CQ and QQ protocols. We start with the QQ case, which is enough to 
imply the CQ case (see |25|). Suppose a set of players B C V^\{d} has access to quantum 
information in a graph G — {V, F). We proved with Theorem|2]that B can access QQ encoded 
quantum information in G if and only if B can access the CQ encoded classical information in 
G and V\{BU{d}) cannot. Thus, by rewriting lemma [T] and |2] applied to B and V\{BU{d}), 
we have: there exists D : B ^¥g undC : BU{d} -^ F, such that C{d) = 1 and 

snp{T[B,V\B].D) = {d} (2) 

T[BU{d},V\{BU{d})].C = (3) 

Now, call Ki = XiZY,{i} and ki = XiZY[v\{d} ,v\{d}]{i} (these are the fixpoint operators, 
or stabiUsers for graphs G and G\d respectively according to ([T)). 

First we have Kc = KaU^eB ^f ^'^ = XdZ^Zr.^d} U^eB ^f ''^ with (3 = r.C(d). Then 
Zr.w U.eB kf^'^ = ^' U.eB xf^^Z^'""^, with A = E,,eBu{.},,<. TO'- *)C(j)C(z). 
Next Kd satisfies Kd = Il^eB ^f ^'^ = ^d Y\i<^b ^f^'^^ with a ^ T.D{d) ^ since (H, 
and n.eB fcf '^^ = ^'' Ili^B Xf ^')<-^«, A' = T..,,<,B,,<^ r(j, ^)D{3)D{l). 
Later we will suppose a — \ (change D io a^^ .D \f necessary). 
Hence KcKd^^^^\G) 

= u'-^^X^MZr.id, n... ^''m.eB kf^']~''\G) 

= \G) 
which is a stabiliser / fixpoint equation involving operators only in d and B which will be used 
to inform which measurements should be made to recover the secret in the CQ case, and how to 



find the QQ decoding operation. We can rewrite this as follows 

{Zr.id}n.eBkf^'^][U.eBk^^'^]'~'^-^'U.eBXtZ!' with 

x,{t)^tC{i) + {l~tl3)D{i) (4) 

z,{t) = tr.C{i) + (1 - tp)T.D{i), (5) 

c = a' + (l-f/3)A + t(t-l)A' + (l-t/?)(-i/3)A + t(l-t/?) Y^ r{i,j)C{i)D{j) (6) 



i,jeB 



and we further define 



Mr):=-r-c-%-^p. (7) 



We can then see that given the state \G)v, if the dealer measures X'^Z, getting result w*^*) and 
each player i in _B measures its qudit in the X^''^*^Z^''^*^ bases, denoting their results mi{t), if 
we define m{t) = /i^^(X]i '>Ti'i{t))^ then the fixpoint stabiliser conditions imply m{t) — s{t). 
This will be the basis of the CQ accessing strategy. 

For the QQ accessing, we define operators Ub and Vb only acting on B such that Ub '■— 

n.6B k-''^'^"~\ which satisfies Ub\sl) = ^1^^) and Vb ■= ^r.{d} Y{^eB fcf ^'^-^^'^^'^ 
which satisfies Vb\sl) = |(s + 1)l)- 

We also define the extended Bell basis as the following bipartite states over a system {a, b}: 
\/k,l e Fq, |/3fe,;)a6 = Za-^b^ie¥ r'' ■ The result {k,l) of a measurement over {a, 6} in the 
Bell basis yield the state as \/3k,i)ab- 

CQ Protocol: 



1 . The dealer prepares the graph state 

and sends one qudit of the state to each player. 

2. The dealer randomly measures its qudit among the bases: {X*Z}teT and denotes 
the result a;*(*\ That leaves the state over the players on \i{t)L)v\{d}- 

3. A player b E B randomly chooses t' E T and send t' to the other players in B using 
their private channel. 

4. Each player i in B measures its qudit in the X^*^* )^zi(t ) j^^gg^ (-ggg Q^Q) and 
sends the result w'"'^*') G {1,ilj, .., w^-ij. to fe. 

5. 6 computes m(f') = f^^(^i'nM{t')) (see©). 

6. Repeat step 1. 2. 3. p — > oo times. The list of measurement results s{t) and m{t') 
are the raw keys of the dealer and players B respectively. 

7. SECURITY TEST: Follow standai-d QKD security steps. Through pubhc discussion 
between d and B first sift the key followed by standard error correction and privacy 
amplification to generate a secure key (see [25 1 and [301). 

Correctness : After the QKD security steps the dealer and the authorised set B will be able 
to share a perfectly secure random key. Furthermore, QQ unauthorised sets for the same graph 
will not be able to establish such a key (see 1251 for proofs). 



QQ Protocol: Let |C)s = I]i'=o Si\i)s G C'' be a quantum secret. 



1 . A dealer prepares the state 

— Y^ s,Zl.^^y\G\d)v\{d} 

V ^ a<i<q-l 

2. The dealer sends one qudit of the resultant state to each player 

3. (measurement) The authorized set B uses two ancillas qudits {ai, a2} prepared in 
the Bell pair state |/3oo)aia2> ^nd performs the following two commuting projective 
measurement on ai, Vj^^X~_^^ and UbZ^^ on , with result denoted k and I respec- 
tively. 

4. (correction) B applies Z^X^^ over the second ancilla {02}. 

Correctness: Ub and Vb satisfy UB\iL)v\{d} = ^1«L)\/\{d}. and VB\iL)v\{d} = \{i + 
l)L)v\{d} Vz € Fg. We can rewrite the state over y\{d}U{ai, 02} as: 

EieF, Si\iL)v\{d} Ejsf, " ^"^ ■ 

= ^ E.GF, Mi^l^i.^L EfcGF, E.GF, ^"-' '"'^^^''"^ S, '^^'■^■^. |j)a. 
— l\^ Trkvl \^ \^Li)v\{d}ai vl 7-fcY^ „ I -x \ 

As v^'x-^\ul,xi^ E..F, ^^^^^™^) = c.'^c/^x^^ E..F, ^'^'^-^J-r' ^"d 

C/BZ-/(L/|Xi^ E,eF, ^i^^^f^) = c.'C/|Xi^ E.GF, ^^^^^^^^, the projective measure- 
ment according to Vg^X^^ and UbZ^^ reveals the syndrome (fc, /), such that the correction 
Z^X^^ over the ancilla {02} leaves the state as Ei Si|*)a2- 

4.2 Example 

We illustrate the use of characterisation of the access structure in a multigraph with a Reed 
Solomon Graph State that allows a quantum secret (or equivalently a random key of dits) to be 
shared between a dealer and all subset of at least ^^^^ players among a set of n players over 
a field of q elements, with q > n. We refer to Il26l . ||8] for more details about Reed Solomon 
Graph for secret sharing. 

We saw B C T^\{<i} can access quantum information with respect to d in G iff there exist 
D : B ->-¥qandC : BU{d} -^ ¥q such that C{d) = 1 and 

sup{r[B, V\B].D) = {d} 
r[BU{d},V\{BU{d})].C ^ 

We rewritte these conditions in the following way: B C l^\{d} can access quantum infor- 
mation in G iff there exist D : B ^ ¥q and C : B (J {d} ^ ¥q such that C{d) = 1 and 
BU{ueV\B I J2veBD{v).r{u,v)y^0 modq}^BU{d}. (5) 

BU {d}U {ue V\{BU{d}) I E„ei3u{d} C{v).T{v, u) ^ modq} = BU {d} (6) 
For A : V -^ ¥q, we call Ga = {Va,^a) the subgraph induced by A such that: 
Va = sup(A) U {w e F\sup(A) I r[sup(A), V\sup{A)].A{v) ^ mod q 
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with B = {V7,VI.V2,V3} 

and D{v7) = 1 



with B = {V6,V7,V2, V3} 

and_D(iiG) = 3, D{v7) = 1 





o'9^6 



a'c,C:dUB^F, 

withC(d) = l,C(iii) = 4 

C(i;2) = 3,C(i>3) = 6 



F„ 



withC(d) = 1,C(U2) 
C{V3) = 3 




a 



■0 
■6 



(a) (4,3,7)7 Reed Solomon 
QQ Graph scheme. 



(b) Examples of subgraphs ^0 associated with subset 
B showing that B can access classical information in 
^ and of subgraphs 5^^ associated with dUB showing 
that V\B cannot have classical infomiation in 'i^. 



Figure 1: Checking quantum accessibility in a (4, 3, 7)7 Reed Solomon Graph. 



{ve,V7., 

{VQ,V7., 
{"5, "7; 
{vi,V7. 

{t)4,tJ5, 



"2 , "3 } 
"2, "3} 
"2, "3} 

fl,f2} 
"2, "3} 
til , tl2 } 
f7,f3} 
"7,"l} 
tJ7,tJl} 
ve,V7} 



{D{b))beBs 



(1,0,0,0) 
(1,0,0,0) 
(3,1,0,0) 
(4,1,0,0) 
(1,1,0,0) 
(4,1,0,0) 
(3,1,0,0) 
(2,2,1,0) 
(5,6,1,0) 
(4,6,1,0) 
(5,6,1,2) 



(C(6))t6du£ 



(1,0,6,0,0) 
(1,0,3,4,1) 
(1,0,0,1,3) 
(1,0,0,5,5) 
(1,0,0,2,1) 
(1,0,0,2,2) 
(1,0,0,1,3) 
(1,0,0,0,2) 
(1,0,0,0,6) 
(1,0,0,0,3) 
(1.0,0,0,0) 



{"6,"1, 

{vi,vi, 
{"6, "7, 

{"5, "7, 
{-"5, -"7, 
{vi,V7, 



"2, "3} 
"2, "3} 
Vl,V2} 
V2,V3} 
"1,"3} 
"1,"3} 
VI, v^} 
V7,V2} 
V7,V3} 
"7, "2} 



(D{b)heBs 



(1,0,0,0) 
(1,0,0,0) 
(1,4,0,0) 
(3,4,0,0) 
(4,3,0,0) 
(3,4,0,0) 
(1,6,0,0) 
(4,1,1,0) 
(1,1,1,0) 
(6,1,4,0) 



(C(6))fcgrfuJ5 



(1,0,2,2,1) 
(1,0,4,6,2) 
(1,0,0,3,6) 
(1,0,0,6,1) 
(1,0,0,1,4) 
(1,0,0,6,1) 
(1,0,0,4,3) 
(1,0,0,0,5) 
(1,0,0,0,6) 
(1.0.0,0,3) 



Table 1 : List of typical subsets S of 4 players in the Reed Solomon Graph State described 
in Fig [la] For each B, BU{u G V\B \ E^g^ ^(«)-r(w, w) ^ mod q} = BU{d} = 
BU{d}U{u e V\{BU{d}) \ Et,esu{d} C'('u)-r(w,-u) ^ mod q}, meaning that B can 
access quantum information, whereas V\{B\j{d}), that is all subset of 3 players, cannot. (The 
remaining subsets are covered by symmetry.) 



and Vui G sup (A), 



rA{vi,Vj) = A{vi)A{vj).r{vi,Vj) ifvj e sup(A) 
TA{vi,Vj) = A{vi)T{vi,Vj) if Wj G Va\sup{A) 



For example, let G = {V, T), deV,\V\ =8,he the (4, 3, 7)7 Reed Solomon Graph State 
given in FigfTal 

Such a graph can be used by dealer d to encode any quantum secret |^) G C^ and share 
it between 7 players such that all subset of at least 4 players can recover the secret, whereas 
any subset of 3 players or less cannot have any information about it. We can reprove this result 
using the previous graph characterisation, that is by checking if conditions (5) (6) are satisfied 
in a basis G for all subset B C VMd} of 4 players. In fig [lb] we give the relevant induced 
subgraphs for thee different subset B. And in table [T] we give a list of relevant multi subset 
D : B —>■ ¥q and C : BU{d} — >■ Fg for typical subsets B of four players. 
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5 Existenceof((A;,n))q scheme 



In this section, we focus on the properties of the secret sharing scheme realised by a given 
Fg-graph, as well as the existence of F^-graphs realising a given secret sharing protocol. A 
Fg-graph G of order n with a particular dealer d is said to realise a {{k,n))q scheme if fc — 1 = 
maxBcy\{d}(5dCutrkG(-B) > 0). In other words, G realises a ((fc, n))g scheme if all sets of 
at least k players can recover a quantum secret and there exists a set of fc — 1 players which 
cannot. A F^-graph which realises an ((fc, n))g scheme can be used as an (fc, k' > n — k, n)q 
CQ protocol or (fc, n — k, n)q QQ protocol as described in section |4] (note that they can also 
be used for (fc, k' > n — k, n)q schemes to share a quantum secret using hybrid protocols (e.g. 

HHlllKiolllT])). 



5.1 Finding new schemes 

Theorem |2] offers a combinatorial characterisation of quantum accessibility, and raises as a 
consequence several questions about the complexity of deciding: (i) whether a given set of 
players can access a quantum secret in a given q-multigraph? (ii) whether a given g-multigraph 
realises a ((fc, n)) protocol? (Hi) whether, given q, n and fc, there exists an F^-graphs realising 
a ((fc,n)) protocol? 

Problem i Given an F^-graph G of order n with a particular dealer d and a set B of k players, 
deciding whether B can access a quantum secret consists of deciding whether ddcntrkoiB) 
— 1. This can be decided efficiently since (9c;cutrkG(i?) is computed in 0{nk^-^^) opera- 
tions using the Gaussian elimination for computing the rank ll6l [T8l . 

Problem ii Given a F^-graph G of order n and a € [0, 1], deciding whether G is a {{an, n)) 
scheme can be done by enumerating all the ('^') sets of players of size an and for each 
of them deciding whether they can access a quantum secret. It leads to 0{n'^''^^2"--^^^°''>) 
operations. This problem is NP-complete, as it has been shown to be NP complete when 
q = 2 \7\, and also hard in terms of parameterised complexity as it is hard for W[l] 17). 

Problem Hi Given n, a, and q, deciding whether there exists a {{an, n)) F^-graph? A brute- 

n(n-l) 

force approach consists in enumerating all the q 2 Fg-graphs of order n and then 
decide whether they realise a ((an, n)) protocol. It leads to 0{q 2 ^2.3S2nH2{a)^ 
operations. This can be implemented for small values of n only and permits to prove that 
there is no (4, 3, 7)3 QQ secret sharing with qutrit graph state. 

Solving problem i can be done with the similar algortihm C of 1 12 1. Note that for one thing, the 
later is more general and can be applied to input states (that is quantum secrets) and to multi- 
graphs of arbitrary dimension (not necessarily prime number). For another thing, it concerns 
rather the access to partial information. Also it is not optimised for problem i of our particular 
interest. 

In the following sections, we develop a different approach for deciding the existence of 
((an, n)) F^-graphs realising. We show an upper and a lower bound on the minimal a such that 
there exists an F^-graph realising a {{an, n)) protocol. The upper bound (Theorem|3) is based 
on non constructive probabilistic methods, whereas the the lower bound (Theorem |4) is based 
on a counting argument. 
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5.2 Existence of g-multigraphs realising {{an, n))g schemes 

In this section, we prove a Gilbert- Varshamov-like result: for any a such that Hg2 (1 — a) < i 
there exists a g-multigraph realising a {{an, n))q scheme. The proof is using probabilistic meth- 
ods and is, as a consequence, non constructive. However, we prove that a random g-multigraph 
satisfies such {{an, n))q scheme with high probability as long as Hqi (1 — a) < ^. 

Lemma 3. For any q-multigraph G = {V, T) of order n, and any a e [0.5,1], if for any multiset 
C -.V -^¥q, |sup(C)Usup(r.C)| > (1 - a)n then for any d eV and any B C V\{d} such 
that \B\ > an, ddCM-irkciB) = -1. 

Proof. For any B C V such that \B\ > an, ker(r[V^\i?]) = {0}, otherwise there would 
be a multiset C such that sup(C) C V\B and |sup(C)Usup(r.C)| < (1 - a)n. So for any 
B C V such that \B\ > an, cutrkG(i?) — n — \B\. As a consequence, for any d E V and 
any B C V\{d} such that \B\ > an, 9dCutrkG(B) = n - \BU{d}\ - {n - \B\) = -1. Thus 
ddCutTkG{B) = -1 D 

A random F^-graph G{n, 1/q) is a F^-graph of order n such that, for every pair of vertices 
u and V, the number of edges between u and v is chosen uniformly at random in Fg. 

Theorem 3. Given q > 2, and a £ [0.5,1] such that Hg2 (1 — a) < ^, for any n G N, a random 
q-multigraph G{n, 1/q) realises a {{an, n))q scheme with probability 1 — 2 *^"', where d is any 
vertex ofG{n, 1/q). 

Proof Let C^ = {C : V ^ ¥q, |sup(C)| < (1 - a)n}. For any C G C let Ac be the (bad) 

event |sup(C)Usup(r.C)| < (1 - a)n. 

For any C G C„, Pr{Ac) = ^^r^ ELT"'^" (''T^")(9 ^ 1)' where c = |sup(C)|/n, and 

Ecec^ Pr{Ac) = Ef=T^" /O') with /(j) = Ecs..|sup(c)|=, MAc)- 

In the following, we show an upperbound on f{k). For any c G [0, 0.5], f{cn) = (c"i)(9 ~ 

2\cn 1 y^(l-a-c)« /'(l-c)n^ /• ]^\fc ^ (g-l)"" o«-H"2 (c) + (l-c)rtg2(^^rg^) /„ 2)'^l~"~g"'" = 

2»9(-) Where 5(c) = H2{c) + (1 - c)iJ2(T^) + (1 - a) log2(g - 1) - (1 - c) log^lg). g'(c) = 
— log2 (c) + log2 ( 1 — a — c) + log2 (g) , so g' (c) =0 -4==> c = -^ ( 1 — a) . As a consequence, 
9{c) < 5(^(1 - a)) = -alog2(«) - (1 - a) log2(a) + (1 - a) log2{q^ - 1) - logal?) = 
log2(g)(2i?,2(l - a) - 1). Thus, Ecec„ -P^(^c) < (1 - a)n(j"[^^'j"(^"")"^l, so, thanks 
to the union bound, Pr{C\^^^^A^) > 1 - (1 - a)nq'''^^"i^^^-°''>-^^ = 1 - 2f^(") when 
2Hqi{\ — a) — 1 < 0. So according to lemma |3] KQ{G,d) < an for any vertex d when 
Hq2{l-a) <l. a 

Theorem |3] extends the upper bound of the binary case (q = 2) fT9l. Notice that even if 
a random F^-graph realises a {{an, n))q scheme with probability almost 1, double checking 
whether a (randomly chosen) Fg-graph actually realises a {{an, n))q scheme is a hard task (see 
Problem in) in section ISTt . 

5.3 Lower bound on quantum accessibility 

The no cloning theorem implies that for any {{an, n)) secret sharing protocol, a > 0.5. In the 
following we improve this lower bound for secret sharing schemes based on qudit graph states. 
The lower bound on a depends on the dimension q (see Theorem |4]l, the value of the lower 
bound is plotted for small values of q in figure |2] 

The lower bound is based on the properties of the kernel with respect to the dealer defined 
as follows: 
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Definition 3. Given a q-multigraph G, for any d € V^G) and any B C V{G)\{d}, let 
Sd{B) = ker(rG[i3U{d}])\ ker(rG[i?]) be the kernel of B with respect to d. 

Lemma 4. Given a q-multigraph G, for any d G V{G) andany B C V{G)\{d], ifddcatrkG{B) 
— 1, there exists G € Sd{B) such that 

|sup(C)| < — ^cutrkG(S) 



Proof Since cutrkG(-BU{d})-cutrkG(-B) == -1, dini(ker(rG[SU{d}]))-dini(ker(rG[B])) = 
2. Moreover, ker(rG[B]) C ker(rG[SU{4]), so \Sd{B)\ = {q^ - l).q* where t = dim(ker( 
Tg[B])). Let M = (^^,) a matrix in standard form (or reduced column echelon form) gener- 
ating TG[BU{d}]. Since \Sd{B)\ = (g^ - i).g* and | ker(rG[BU{d}])| = g*+2, there exist 
two columns Ci and C2 of 1\I such that V(a;, y) e [0, q - 1]^\{(0, 0)}, a^-Ci + J/.C2 G 5d(B). 
Notice that since M is in standard form, |sup(Ci)Usup(C2)| < \B\ + 1 — t. Moreover for any 
V £ sup(Ci)Usup(C2), whas a zero multiplicity in g— 1 vectorsof the q^ — 1 linear combinations 
x.Gi+y.G2foTx,y G [0,g - 1]\{(0, 0)}, so X;(^,j,)e[o,g-i]2\{(o,o)} |sup(a;.Ci + 2/.C2)| = 
(g^ - 1 - (g - l)).|sup(Ci)Usup(C2)|, so there exists G £ Sd{B) such that |sup(C)| < 
f^dSl + 1 - t) = ^(cutrkG(S) + 1) < ^cutrkG(i?). D 

Theorem 4. //'a q-multigraph G of order n realises a {{an, n))q scheme, then 

n \ f an \ {2a — 1)(1 — a) / n 



Asymptotically, as n tends to infinity, a satisfies: 

q+ I a 

Proof. Given Bq of size an, according to lemma|4]there exists Co G 5d(i3o) such that |sup(Co)| < 
—2^(1 — a)n. Notice that the set sup(Co)Usup(rG-Co) has some partial information about the 
secret so |sup(Co)Usup(rG-Co)| > (1 — a)n. Moreover for any B of size an, if Co G Sq{B) 
then sup(C)Usup(rG.C) C B. So there are at most {"'^ll^^I^^^J^) = ((2a"riVJ ^^^^ ^ ^ 
V\{d} of size an such that Cq G Sd{B). For any B of size an there is a C which support 
is of size at most — f]-(l — a)n — 1, any every such C is associated with at most {(2a-i)n) 

such Bs, so a counting argument impUes C"-^) < {,2a-i)n) Ei^^^ "''""^ ("7^)- More- 



over 



V(2 
. Y^1+t(^ '"')"'- ^ (n-l\ ^ l+aq( n-1 N _ {l-a)(l+aq) f n \ o (d) 



< 



^^^^^ ((2l"ri5„) (2a-l)(l-a)(g+l) 

((l-|i2^) < (2„_i)(i_„)((i_|i2^)- 

Since 2"(^2(p)+o(i)) < ( » ) < 2"-"^(p\ asymptotically, as n tends to infinity, a satisfies 
the equation H2 ( ^ ) + aif 2 ( ^ ) > -^2 (a) . D 
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Figure 2: Lower bound on the accessibility to quantum information in a ((fc,n))g scheme. There 
is no ((fc, n))q scheme with k < an 

6 Discussion 



In this work we have studied the encoding of classical and quantum information onto graph 
states of qudits, and its application for secret sharing schemes. We have given complete graph- 
ical characterization of which sets of vertices (players) can access the information, and shown 
how this can be done both for classical and quantum information. Using this characterization 
we have given bounds on which protocols are possible and how difficult the access structure is 
to calculate given a graph. 

Whilst we have focused on the application of our results for secret sharing, there may be ap- 
plications to other quantum information protocols. Indeed, the QQ encoding defined in section 
12.31 is exactly the same encoding procedure used in measurement based quantum computing 
and error correction, so we can expect that these results have implications in both these do- 
mains. Furthermore, quantum secret sharing is intimately linked to error correction Il25] l8l. All 
secret sharing schemes are error correcting schemes, and the QQ protocols presented here are 
equivalent to all possible stabilizer codes [25 1. Thus, the existence of {{an, n)) protocols is 
an existence statement about error correcting protocols too, and the no goes on secret sharing 
imply no-goes for all stabilizer codes - so that there are no stabilizer codes with parameters 
violating our lower bounds. 
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7 Appendix-QQ Encoding-Decoding Operations 

The QQ encoding-decoding can basically be done by three typical ways. The first method 
is based on projective Bell measurements (possibly extended to an |i3| + 1 length state) and 
the two last one are accessible by local measurements and/or implementation of control op- 
erations between two qudits, which should finally result in a similar experimental complexity. 
We briefly describe the three encoding method E\, E2, E3 and decoding D2, D'S. {Dl has 
been done in section 14711) . For a graph G = {V,T), with d ^ V, W := V\{d}, a quan- 
tum secret |0s := J2'iZo Si\i)s, we write X := Z^d} and Z := (X„Zr{„})~^^"'''^ , 
for u,T{u,d) 7^ 0, as they act like logical operators over the bases states over W, that is 
Z\iL) =uj'\iL),X\iL) = |(i + l)L> with notation of O 

- ^, EteF, isX^oXl^iE,^,^ E,,F, u''-^-^ E,^-'-'^Ajl)w) 

= 7f E/6F, IsX\jXly{J2ke¥^ Z^IdZ^ Ej6F, ' 'q " Ej SjeF, \Jl)w) 

= g E/,fcGF, ^S^D(EiGF, ^ ° )XwZw SjSF, ^^JLIw) 

SO that applying the correction: Z^X~^ over V\{d], according to the syndrom [l, k) of a Bell 
measurement over {5', D}, leaves the state over W as EieF ■SiNi)- 

E2 cxME^eF, s^N))|Ol) = E,6F, ■s,\^)x'\Ol) = E.^f, ^^I^^l) = E.^f, s.^io)!*^) 
= E.eF, s^x^ E,,F, ^Nl) = E.sF, ^'^x^ E, ^^Nl> = ^ E,, s.u;^■^Z'^\bo)\^L) 

= E,,F,^(^^E.,F,^^Ni)) 
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where \bk) = Z^ ^^ \i) constitutes the X basis (|6o) = |+))- so that the correction Z ' over 
W , according to a X]^ measurement leaves the state to distribute as ^^ Si\iL)- 121 

E3 CZiwHaCXaw^,s^\i))\^L) = CZdM/i^d(E.s.N)NL)) 

= cZd„.(E. s,\hM))\^L)) = 1+) E. s.Nl)) 

The same process can be done for the decoding by an authorised set B, where the operators 
Vb and Vg defined in 14. II will act as Z and X operators respectively. An ancilla qudit {a} is 
prepared in the state |+)a by B. 

D3. CU^B.Ua.^^ EfeeF, ^-'(E,eF, S,\^a)\kL)w - E.eF, ^#«)a E.eF™ ^ 

The explicit two qudits gate control operations B has to perform are given by decoding param- 
eters (xi, Zi, c) defined in 14. II 
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